<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
   <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
   <meta name="GENERATOR" content="Mozilla/4.75 [en] (X11; U; Linux 2.2.14 i686) [Netscape]">
<TITLE="Examples and Tests">
</head>
<body bgcolor="#FFFFFF">

<h1>
Examples and Tests</h1>
<a href="#dumpData">Single Timeline Dumping Data</a>
<br><a href="#filterTest">Filter Player Test</a>
<br>(subject to update)
<br>
<hr WIDTH="100%">
<p>
<hr WIDTH="100%">
<h3>
<a NAME="dumpData"></a>Single Timeline Dumping Data</h3>
This is a test to verify that the NetFlow is working correctly with <i>SSF.Util.Stream</i>
package and the <i>SSF.OS.ProbeSession.</i> It has two clients, two servers
and two routers with monitors installed. All these hosts are configured
to run in a single time line, so the two monitors should dump data to a
single file.
<p>Original DML config file:<a href="../tests/dumpData.dml">dumpData.dml</a>
<br>Raw output file (binary):<a href="../tests/flow_data/dumpData.dat.0">dumpData.dat.0</a> If "File Not Found", please go to ssfnet/src/SSF/OS/NetFlow/tests, and do "make dumpData".

<p><i>Part of the DML config</i>
<center><table BORDER WIDTH="100%" BGCOLOR="#CCCCCC" >
<tr>
<td># dumpData
<br>#
<br># ()&nbsp; &lt;--- client/server
<br># [*] &lt;--- router
<br>#
<br>#
<br>#&nbsp;&nbsp; clients&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
servers
<br>#&nbsp;&nbsp;&nbsp; ()---&nbsp;&nbsp;&nbsp; routes&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
---()
<br>#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
|---[*]---[*]---|
<br>#&nbsp;&nbsp;&nbsp; ()---&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
---()
<br>#
<br>#
<br>&nbsp;&nbsp;&nbsp; ... ...
<br>&nbsp;&nbsp;&nbsp; ... ...
<br>&nbsp;&nbsp;&nbsp; # The protocol graph of the router.
<br>&nbsp;&nbsp;&nbsp; routerGraph [graph [
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ProtocolSession [name ospf
use SSF.OS.OSPF.sOSPF]
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ProtocolSession [
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
name ip use SSF.OS.IP
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Monitor [
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
use SSF.OS.NetFlow.IpFlowCollector
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
debug true
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
protocol_type tcp
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
init_capacity 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#init FlowTable size
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
]
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ]
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ProtocolSession [
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
name probe use SSF.OS.ProbeSession
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
file "flow_data/dumpData.dat"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#the file prefix to dump NetFlow data
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
stream ipnetflow
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ]
<br>&nbsp;&nbsp;&nbsp; ]]
<p>&nbsp;&nbsp;&nbsp;&nbsp; ... ...
<br>&nbsp;&nbsp;&nbsp;&nbsp; ... ...</td>
</tr>
</table></center>

<p><a NAME="dumpDataOutput"></a><i>Part of the output printed out</i> (Sorry that you may need to make
the window wide enough to have a clean look of it.) In this test, the two
clients each send a request of 1000000-byte-file transfer to one of the
server. Given that the communication is bi-directional, there should be
four flows in the system. Also notice that there are two monitors on the
way, there shoul d be 4 * 2 = 8 flow records in the result file. Below
are the main result of one test run. If you take a closer look, you can
tell the time shift(First &amp; Last) of the same flow recorded by different
routers (the nhi of the routers are 1 and 9). The traffi c size is more
than 1000000 bytes because there are also TCP headers and other communication
overhead. <U><I>Notice: these following are the records before "nextHop" is added to IpNetFlow. The nextHop IP will be printed between the "output" and the "dPkts"</I></U>
<center><table BORDER WIDTH="100%" BGCOLOR="#CCCCCC" >
<tr>
<td>srcAddr&nbsp;&nbsp;&nbsp; dstAddr&nbsp;&nbsp;&nbsp;&nbsp; nhi&nbsp;
input output&nbsp; dPkts&nbsp; dOctets&nbsp;&nbsp; First&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Last&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcpflag&nbsp;&nbsp;
prot&nbsp;&nbsp; srcmask dstmask
<br>13.0.0.0&nbsp;&nbsp;&nbsp; 9.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1004&nbsp;&nbsp;&nbsp; 20084&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
2.915603&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8.135219&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
13&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp; ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
ff
<br>9.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 17.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1003&nbsp;&nbsp;&nbsp; 1020060&nbsp;
4.9923124&nbsp;&nbsp;&nbsp; 10.284944&nbsp;&nbsp;&nbsp;&nbsp; 13&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
tcp&nbsp;&nbsp;&nbsp;&nbsp; ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
ff
<br>17.0.0.0&nbsp;&nbsp;&nbsp; 9.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1004&nbsp;&nbsp;&nbsp; 20084&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
4.97231&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 10.264973&nbsp;&nbsp;&nbsp;&nbsp;
13&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp; ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
ff
<br>9.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 13.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1003&nbsp;&nbsp;&nbsp; 1020060&nbsp;
2.9356055&nbsp;&nbsp;&nbsp; 8.1551895&nbsp;&nbsp;&nbsp;&nbsp; 13&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
tcp&nbsp;&nbsp;&nbsp;&nbsp; ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
ff
<br>13.0.0.0&nbsp;&nbsp;&nbsp; 9.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1004&nbsp;&nbsp;&nbsp; 20084&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
2.9056015&nbsp;&nbsp;&nbsp; 8.125217&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
13&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp; ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
ff
<br>9.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 17.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1003&nbsp;&nbsp;&nbsp; 1020060&nbsp;
5.002314&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 10.294945&nbsp;&nbsp;&nbsp;&nbsp;
13&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp; ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
ff
<br>17.0.0.0&nbsp;&nbsp;&nbsp; 9.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1004&nbsp;&nbsp;&nbsp; 20084&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
4.962309&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 10.2549715&nbsp;&nbsp; 13&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
tcp&nbsp;&nbsp;&nbsp;&nbsp; ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
ff
<br>9.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 13.0.0.0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1003&nbsp;&nbsp;&nbsp; 1020060&nbsp;
2.9456067&nbsp;&nbsp;&nbsp; 8.165191&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
13&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; tcp&nbsp;&nbsp;&nbsp;&nbsp; ff&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
ff</td>
</tr>
</table></center>

<h3>
<a NAME="filterTest"></a>Filter Player Test</h3>
This is a test of "<i>SSF.OS.NetFlow.Filter</i>" package. It uses the filterPlayer,
filter the data generated in the previous example <a href="#dumpData">Dumping
Data</a>.
<br>Original DML file: <a href="../tests/filterTest.dml">filterTest.dml</a>
<br>Raw output file: <a href="../tests/filterTest.out">filterTest.out</a>. If "File Not Found", pleaes go to ssfnet/src/SSF/OS/NetFlow/tests, do "make filterTest".
<br>The DML that configs the filter:
<center><table BORDER WIDTH="100%" BGCOLOR="#CCCCCC" >
<tr>
<td># filterTest.dml
<br>#
<br># It filter the IpNetFlow data. Two kind of flow record will pass this
filter:
<br># The first kind is The flow record recorded by router 9(nhi_address);
the
<br># seconed kind is the flow records that has traffic size (dOctets)
between
<br># 20000 and 30000 bytes and starts between time (First) 2 and 3. In
short,&nbsp;
<br># they are records:
<br># (recorded by router 9)&nbsp;
<br>#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; OR ( (20000&lt;=dOctets&lt;=30000)
AND (2&lt;=First&lt;=3) )
<br>#
<br>filter [
<br>&nbsp; #----------------------------------------------- Decoders
<br>&nbsp; decoder [&nbsp;
<br>&nbsp;&nbsp;&nbsp; record_type IpFlowCollector
<br>&nbsp;&nbsp;&nbsp; use SSF.OS.NetFlow.Filter.IpNetFlowDecoder
<br>&nbsp; ]
<br>&nbsp; #----------------------------------------------- term 1&nbsp;
<br>&nbsp; term [
<br>&nbsp;&nbsp;&nbsp; factor [
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; field_name nhi
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; field_type string
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; range [
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; reg_exp 9
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ]
<br>&nbsp;&nbsp;&nbsp; ]
<br>&nbsp; ]
<br>&nbsp; #----------------------------------------------- term 2
<br>&nbsp; term [
<br>&nbsp;&nbsp;&nbsp; factor [
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; field_name dOctets
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; field_type int
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; range [
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; min 20000
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; max 30000
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ]
<br>&nbsp;&nbsp;&nbsp; ]
<br>&nbsp;&nbsp;&nbsp; factor [
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; field_name First
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; field_type float
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; range [
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; min 2
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; max 3
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ]
<br>&nbsp;&nbsp;&nbsp; ]
<br>&nbsp; ]
<br>]
<br>&nbsp;</td>
</tr>
</table></center>
As it explained, two kinds of IpNetFlow records will pass this filter:
records that recorded by router 9; records has dOctets in [20000, 30000]
and First in [2, 3]. Take a look at the <a href="#dumpDataOutput">output</a>
of the previous test, there are eight records there. The first four satisfy
the condition because they are recorded by router 9, the fifth should also
pass because it satisfy the second condition. The rest 3 would failed to
pass and they won't show in the result. The output of the filter is printed
as follows: (<U><I>Notice: These following are records before nextHop is added to IpNetFlow.</I></U>)
<center><table BORDER WIDTH="100%" BGCOLOR="#CCCCCC" >
<tr>
<td>[type=3 ("IpFlowCollector")&nbsp; source=4 ("9")&nbsp; time=30.0&nbsp;
bytes=34]
<br>9.0.0.0&nbsp;&nbsp; 13.0.0.0&nbsp; 9&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;
2&nbsp;&nbsp; 1003&nbsp;&nbsp; 1020060&nbsp;&nbsp; 2.9356055&nbsp;&nbsp;&nbsp;
8.1551895&nbsp;&nbsp; 13&nbsp;&nbsp; tcp&nbsp; ff&nbsp; ff
<br>[type=3 ("IpFlowCollector")&nbsp; source=4 ("9")&nbsp; time=30.0&nbsp;
bytes=34]
<br>17.0.0.0 9.0.0.0&nbsp;&nbsp;&nbsp; 9&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;
0&nbsp;&nbsp; 1004&nbsp;&nbsp; 20084&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
4.97231&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 10.264973&nbsp;&nbsp;
13&nbsp;&nbsp; tcp&nbsp; ff ff
<br>[type=3 ("IpFlowCollector")&nbsp; source=4 ("9")&nbsp; time=30.0&nbsp;
bytes=34]
<br>9.0.0.0&nbsp;&nbsp; 17.0.0.0&nbsp; 9&nbsp;&nbsp;&nbsp; 0&nbsp;&nbsp;&nbsp;
2&nbsp;&nbsp; 1003&nbsp;&nbsp; 1020060&nbsp;&nbsp; 4.9923124&nbsp;&nbsp;&nbsp;
10.284944&nbsp;&nbsp; 13&nbsp;&nbsp; tcp&nbsp; ff ff
<br>[type=3 ("IpFlowCollector")&nbsp; source=4 ("9")&nbsp; time=30.0&nbsp;
bytes=34]
<br>13.0.0.0 9.0.0.0&nbsp;&nbsp;&nbsp; 9&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;
0&nbsp;&nbsp; 1004&nbsp;&nbsp; 20084&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
2.915603&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8.135219&nbsp;&nbsp;&nbsp;&nbsp;
13&nbsp;&nbsp; tcp&nbsp; ff ff
<br>[type=3 ("IpFlowCollector")&nbsp; source=2 ("1")&nbsp; time=44.999996185302734&nbsp;
bytes=34]
<br>13.0.0.0 9.0.0.0&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;
0&nbsp;&nbsp; 1004&nbsp;&nbsp; 20084&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
2.9056015&nbsp;&nbsp;&nbsp; 8.125217&nbsp;&nbsp;&nbsp;&nbsp; 13&nbsp;&nbsp;
tcp&nbsp; ff ff</td>
</tr>
</table></center>

</body>
</html>
